Senior Staff Security Engineer, Product Security

As a Senior Staff Security Engineer for Product Security at Ripple, you will be one of Ripple's most senior technical security practitioners, operating at the intersection of application security, cloud infrastructure security, and secure software delivery. You serve as the dedicated security engineering partner for Ripple Treasury, leading the technical direction for product and infrastructure security while raising the technical bar as the engineering organization scales across new products and architectures.

What you'll do

• Own the security posture of the Treasury solution and infrastructure environment from assessment through remediation and ongoing maturity improvement.
• Lead threat modeling and security architecture reviews across Treasury offerings.
• Own the secure software development lifecycle for your product surface area, defining security guardrails, CI/CD integrations, and developer guidance.
• Drive the cloud security architecture for Treasury across Azure and AWS, including IAM, network segmentation, encryption, zero trust controls, Kubernetes traffic policies, and DDoS and WAF strategy.
• Partner with GRC to ensure Treasury meets its compliance obligations across SOC 2, ISO 27001, and applicable financial regulatory frameworks.
• Own vulnerability discovery via security assessments, penetration testing and bug bounty, driving findings through triage, prioritization, remediation, and validation.
• Build and scale a Security Champions model within Treasury Engineering, embedding security advocates to extend the Security Engineering team's reach.
• Influence engineering architecture decisions at the senior level, participating in design reviews with the standing to raise security concerns that get acted on.
• Mentor and develop Security Engineers, raising the technical bar through threat model walkthroughs and design discussions.
• Stay ahead of the threat landscape for FinTech, crypto, and enterprise treasury systems, translating emerging attack techniques into concrete defensive improvements.

What you bring

• 10+ years of Security Engineering experience, including hands-on work in Product Security and Infrastructure Security.
• Expert-level product security skills including threat modeling using STRIDE or equivalent, security architecture review, OWASP Top 10 and beyond, API security, authentication and authorization design, and secure SDLC development.
• Deep expertise in securing cloud environments across Azure, AWS, and/or GCP, covering IAM architecture, network security, secrets management, container and Kubernetes security, and infrastructure as code security.
• Hands-on experience building and operating DevSecOps tooling, including static analysis, dynamic analysis, software composition analysis, secrets scanning, container scanning, and CI/CD pipeline security integration.
• Strong software engineering skills in Python, Go, or equivalent, with the ability to build security tooling, automate controls, and integrate security into engineering workflows.
• Experience with cryptographic principles and key management, including HSMs, MPC, PKI, and key rotation, with an understanding of the consequences of key management failure in financial infrastructure.
• A practitioner's approach, most effective when close to the work: writing threat models, reviewing architecture documents, reading code, and building tooling.

Nice to have

• Background in FinTech, crypto, blockchain, or high-stakes financial environments, particularly where security failures have direct customer or systemic financial impact.

What we offer

• Annual base salary of $220,000-$300,000 USD for positions based in Illinois, plus equity and bonuses.
• Competitive benefits covering physical and mental healthcare, retirement, family forming, and family support.
• Professional development budget to support learning.
• Flexible in-office collaboration, with managers and teams deciding which 10+ days a month they come in.
• R&R days to rest and recharge, generous wellness reimbursement, and weekly onsite and virtual wellness programming.
• Generous vacation policy to take time off when you need it.
• Industry-leading parental leave policies and family planning benefits.
• Employee giving match and mobile phone stipend.
• Team offsites, bonding activities, and catered lunches with fully-stocked kitchens.

About Ripple

Ripple is building a world where value moves like information does today through crypto solutions for financial institutions, businesses, governments and developers. The company improves the global financial system and creates greater economic fairness and opportunity for more people around the world.